Unpatched Apache Flaw Allows The Attacker To Access Protected Directories

Today Apache acknowledged another reverse proxy issue (CVE-2011-4317) which I discovered while creating a QualysGuard vulnerability signature for an older problem CVE-2011-3368. Depending on the reverse proxy configuration, the vulnerability could allow access to internal systems from the Internet.

While reviewing the patch for the older issue CVE-2011-3368, it appeared that it was still possible to make use of a crafted request that could exploit a fully patched Apache Web Server (Apache 2.2.21 with CVE-2011-3368 patch applied) to allow access to internal systems if the reverse proxy rules are configured incorrectly. I submitted an advisory and proof of concept to Apache and Apache made the issue public today.

For a good description of the older CVE-2011-3368 issue as well as how a reverse proxy works please check the excellent blog post by Context.

Here is a description of the new issue CVE-2011-4317 and its proof of concept.

Apache’s patch for CVE-2011-3368

The patch for CVE-2011-3368 (see Figure 1) is straight forward and self explanatory. The “server/protocol.c” file was modified. The patch looks at the request being sent and returns a HTTP 400 Response (Bad Request) if the URL does not begin with a forward slash “/”.

--- httpd-2.2.21/server/protocol.c
+++ httpd-2.2.21/server/protocol.c
@@ -640,6 +640,25 @@

     ap_parse_uri(r, uri);

+    /* RFC 2616: +     *   Request-URI    = "*" | absoluteURI | abs_path | authority
+     * +     * authority is a special case for CONNECT.  If the request is not
+     * using CONNECT, and the parsed URI does not have scheme, and
+     * it does not begin with '/', and it is not '*', then, fail
+     * and give a 400 response. */
+    if (r->method_number != M_CONNECT
+        && !r->parsed_uri.scheme    <-- A
+        && uri[0] != '/'
+        && !(uri[0] == '*' && uri[1] == '\0')) {
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+                      "invalid request-URI %s", uri);
+        r->args = NULL;
+        r->hostname = NULL;
+        r->status = HTTP_BAD_REQUEST;
+        r->uri = apr_pstrdup(r->pool, uri);
+    }
+
     if (ll[0]) {
         r->assbackwards = 0;
         pro = ll;

Figure 1

This part of the code takes care of the issue for CVE-2011-3368. However; if you carefully look at the patch, it does not process URIs that have a scheme (see Figure 1, A). So, if a malformed URL request with a scheme was constructed, it would still be possible to bypass security and gain access to systems on the internal server provided that the reverse proxy rules were incorrectly configured.

Proof of Concepts

Target: Fully patched Apache Web Server (Version 2.2.21) with CVE-2011-3368 patch applied, with a reverse proxy set up and incorrectly configured RewriteRule/ProxyPassMatch rules.

Rewrite rules in httpd.conf:

RewriteRule ^(.*) http://10.40.2.159$1
ProxyPassMatch ^(.*) http://10.40.2.159$1

Example 1:
GET @localhost:: HTTP/1.0\r\n\r\n
where is any port number being requested.

To demonstrate the proof of concept, Tomcat was set up to run on port 8880 on the internal server. Please note that any application could be running on any port on the internal server and a malicious user could use the PoC to request access to an application running on that port.

Access to internal web server can be possible by using a crafted request like:
GET @localhost::8880 HTTP/1.0\r\n\r\n

The screenshot below shows that a basic query with the crafted request (see Figure 2, B) to the target results in access to the page at 8880 (see Figure 2, C).

Figure 2

Upon receiving the request, Apache translates the URL by applying the rewrite rules. The "uri" extracted is ":8880" which gets appended, resulting in the URL

http://10.40.2.159:8880

The "uri" extracted in this case is everything following the first occurrence of the colon (:) in the request. Since the crafted request has 2 colons (::), the second colon is treated as being part of the URI.

To view the URI being extracted based on the rewrite rules, “RewriteLogLevel” was set to 3 in Apache configuration file. The rewrite translation logs get written to the log file. The first step to come up with the crafted request was to review the log file by sending different requests and studying how the rewrite translation was working. In the case of Example 1, since everything following the first colon (:) was being treated as the URI, a second colon was appended with a port number to see the response. The server treated the second “:” as being part of the URI and since there was an application already running on the port, it was possible to gain access to the page.

Example 2:
GET :@ HTTP/1.0\r\n\r\n
where is any string, is the domain of an internal server being requested.

Access to internal web server can be possible by using a crafted request like:
GET qualys:@qqq.qq.qualys.com HTTP/1.0\r\n\r\n

The screenshot below shows that a basic query with the crafted request to an internal website (see Figure 3, D) allows access to the page remotely (see Figure 3, E).

Figure 3

Upon receiving the request, Apache translates the URL by applying the rewrite rules. The "uri" extracted is "@qqq.qq.qualys.com" which gets appended, resulting in the URL

http://10.40.2.159@qqq.qq.qualys.com

The "uri" extracted in this case is everything following the first occurrence of the colon (:) in the request. This is treated as @ giving access to the internal if no authentication is required.

Workaround

Apache has not yet released a patch for this issue. Until a patch is release, configuring the reverse proxy rules in the apache configuration file correctly will prevent this issue from occurring. For example, in the above case, if the reverse proxy rules (RewriteRule or ProxyPassMatch directives in httpd.conf) are configured as follows, the proof of concept will not work.

RewriteRule ^(.*) http://10.40.2.159/$1
ProxyPassMatch ^(.*) http://10.40.2.159/$1

Source 

community.qualys

iOS 5.0.1 up and running

Good News for all iOS 5.0.1 has been jailbroken successfully and that too untethered.....
In this guide i will show you exactly how to do this.


Lets initiate the process.....


REQUIREMENTS

1. iOS 5.0.1 ipsw file (google it and you'll find many there).
2. Redsnow 0.9.10 b3 (b3 is very important b1 and b2 conatain lots of bugs again google will help).
3. Requires iTunes 10.5 or later.
4. iDevice (iPhone above 3G would be required because of speed 3G will hang a lot)

So we are done with the requirements so now this will be it. Here are the Steps......

1. First of all put your iDevice in DFU mode. You can do it in redsnow itself.
• Start rednsow -> Click Extras -> Pwned DFU mode -> Follow the instructions on the screen
• For users who want to know about PWNED DFU mode- it is a deep DFU mode where the device accepts the iPhone for update without checking for many things like custom firmware. For more information just mail me at charanjit@borntohack.in
  
2. After getting into DFU mode screen must be black without anything on it. Then Start iTunes and hit shift+restore (for Windows users) or alt+restore (for Mac Users) and then browse to the ipsw file that you download of iOS 5.0.1
   
3. After all the things done your iPhone must come to life with the iPhone setup on the screen. You can do it but i recommend to jailbreak it first.
   
4. To jailbreak the device open redsnow 0.9.10 b3 again.
• goto extras->select ipsw -> browse to the download iOS 5.0.1 ipsw-> hit back.
• Now you should be on the screen where you selected Extras but this time select jailbreak.
• Follow the instructions on the screen when you hit next on redsnow
  
5. Now you have a jailbroken device in your hand.......  You can try Appsync 5.0+ if you want to install cracked apps just add the repository http://cydia.hackulo.us....
   While running cydia keep one thing in mind donot let the the screen get locked as update stops. For more information read step 6.
   
   
   (iPod, iPad and iPhone(who have official carrier) people stop here )
   
   
6. Now for those who want to unlock their iPhone for unofficial carriers just go to cydia and wait for the updating to finish ( you can see cydia updating on the top when the black bar is there and update is running. Here donot let the the screen get locked as update stops). Now install ultrasnow 1.2.5. it only supports a few basebands read my previous posts.
   
   
   Now you are done with the device go on have fun!!!!!!
   If any problem occurs the mail me at charanjit@borntohack.in OR just comment here......

Beware! New Picture Worm Hits Facebook Today

From last few months, Facebook has been widely targeted for scam and spreading malware, One of the those spreading worm I discovered recently was when I was chatting with my friend, The following message from the sudden appeared.

hehehI!!! lool http://tinyurl.com/Wooo-2841-jpg

From the above screenshot, you can clearly see that tinyurl has been used to shorten the URL, One more thing to note is that it's not an image file as image files end with .JPG extension then -jpg.

The above screenshot describes a more clear picture of what you are going to download along with the JPG file. The exe is basically a Zeus Trojan, Zeus is one of the most popular botnets used for stealing sensitive information such as passwords, credit card numbers. One of it's popular feature is an Anti VM and Anti Sandbox capability, Making it useless for testing it inside virtual environments. 

A scan at Virus total shows that only 3/18 URL scanners were able to detect it as a malware site, Rest of them failed. 

Kindly spread the news by sharing it with your friends and people you know, So they should not fall for the malware.

Source -
rafayhackingarticles

Photojojo Lens Dial Case

The Photojojo lens dial case adds three camera lenses to your iPhone.

The iPhone Lens Dial boasts three optical-quality coated glass lenses: Wide Angle, Fisheye, and Telephoto. All wrapped up in an aircraft-grade aluminum jacket that has two tripod mounts (for portrait or landscape shots). To switch between lenses just rotate the disc! Best part: the lenses never leave your phone, so they’re always at the ready.

Use the 0.7x Wide Angle for sweeping landscapes or get fun warped images with the 0.33x Fisheye. Switch to the 1.5x Telephoto and get nearly two times closer to your subject.

You can purchase the Photojojo Lens Dial case for $249 at the link below…
Read More

Hashing Denial-Of-Service Attack Leaves More Than Half Of The Internet Vulnerable

A recent research Alexander “alech” Klink and Julian “zeri” Wälde shows that more than half of Internet is vulnerable to Hashing Denial of service vulnerability. The HDOS vulnerability exploits the hash tables consuming more than 99% of the CPU usage hence causing a Denial of service attack.

The security researchers demonstrated the  HDOS vulnerability at 28th Chaos Communication Congress security conference in Berlin, Germany, Earth, Milky Way. The talk was titled as "Efficient Denial of Service Attacks on Web Application Platforms". The reaserch shows that most of the web programming languages including PHP, ASP.NET, Java, Python, Ruby, Apache Tomcat (The list goes on and on) are vulnerable to the HDOS vulnerability

PHP 5, Java, ASP.NET as well as V8 are fully vulnerable to this issue and PHP 4, Python and Ruby are partially vulnerable, depending on version or whether the server running the code is a 32-bit or 64-bit machine. 

 Hash tables are a commonly used data structure in most programming languages," they explained. "Web application servers or platforms commonly parse attacker-controlled POST form data into hash tables automatically, so that they can be accessed by application developers. If the language does not provide a randomized hash function or the application server does not recognize attacks using multi-collisions, an attacker can degenerate the hash table by sending lots of colliding keys.  

The algorithmic complexity of inserting n elements into the table then goes to O(n**2), making it possible to exhaust hours of CPU time using a single HTTP request."

Demonstration

The researchers have also posted a video demonstration as a proof of the vulnerability.

Countermeasures


Mircosoft has also provided the workaround for the asp.net vulnerability, You can find it here.

PHP advises to limit the number of different http request parameters. For this purpose PHP has added a max_input_vars function which gives the flexibility to limit the number of paramters.

Furthur Resources:

If you would like to learn more about the vulnerability, here are some useful links:

http://www.ocert.org/advisories/ocert-2011-003.html
http://permalink.gmane.org/gmane.comp.security.full-disclosure/83694

Unlock Your iPhone 4S Without Jailbreaking

A new unlock method has surfaced today which claims to work without the need of any software, hardware or jailbreak.

A bug in iOS 5 discovered by Michael Capozzi theoretically allows any iPhone 4S to be unlocked to any GSM carrier. However, Capozzi says he was only able to test with T-Mobile.
We are currently working towards independent confirmation of his method. It does require you to have an active T-Mobile SIM card (with data working). Remember it must be cut to micro-SIM size to fit the iPhone 4S.

 
The Steps:
? Insert original carrier AT&T SIM card
? Dial 611 for AT&T customer service hotline and drop the call
? Turn on Airplane Mode
? Take out AT&T SIM card
? Insert T-Mobile SIM card
? Make sure WiFi is off ( also tap on ‘Forget this Network” to make sure it doesn’t connect automatically later)
? Switch off Airplane Mode and iPhone will search for network. This is followed by the Apple splash screen appearing.
? Activation Required will be displayed on the screen
? EDGE network will activate automatically – notice the ‘E’ on the top left corner of the screen
? Wait for about 20-30 seconds and turn off the phone
? Turn on iPhone and the same Activation Required screen will be displayed
? When you see one signal bar, tap on Use Cellular Connection
? Eject SIM card
? Activation Required screen will be displayed the second time
? Insert SIM card
? Unlocked!
We are getting some confirmation reports. If you are able to test this, please let us know your results. Remember this method may unlock your device; however, it will not last through a reboot. So while not practical for day to day use. It may benefit those traveling abroad.

Update:
Gizmodo is claiming some confirmation as well.

Update x2:
MuscleNerd notes that while you might be able to successfully get network access, you will lose it once the network is refreshed which makes this procedure even less useful.
“If you are successful at temporarily gaining network access, you’ll lose it as soon as TMSI is refreshed (happens often)”

Borntohack Members Wishes You , Happy New Year ...!!!

iMessages going to stolen iPhones? There may be a fix in the works

iPhone users whose devices have been stolen may soon get a little help from Apple when it comes to the problem of iMessages going to the pilfered phone. Ars has heard that Apple may be planning changes to the way iMessages are handled that will make it simpler for users to lock out unauthorized devices, though it's unclear when that might happen. In the meantime, some users are finding that there are some temporary "fixes" to the problem of iMessages going to stolen phones.

Ars covered this phenomenon last week when Ars reader David Hovis contacted us to tell us his wife's tale of woe. To recap: Mrs. Hovis' iPhone 4S was stolen, so she remotely wiped the device and then asked her carrier to deactivate the SIM. She then purchased a new iPhone and activated it with her old number—theoretically erasing all traces of her information from the original stolen phone. But when Hovis began sending iMessages to his wife, both she and the new owner of the stolen phone received them—Hovis and the new owner had a somewhat lengthy dialogue back and forth about the issue in order to confirm, and the new owner (who had allegedly purchased the stolen device from someone for $500) seemed just as perplexed as Hovis.
Several threads posted online recounted similar horror stories, and after publishing our piece, we received e-mails from a number of other affected users. One user who contacted us was deeply concerned that someone she knew as a stalker might have stolen her iPhone, and that all iMessages directed at her (on a new phone) were also going to the stalker. Clearly, this can turn into a major concern for some iPhone users.

The "fixes"

So what is a worried iPhone user to do to protect yourself? There's a growing consensus that there are indeed some ways to prevent iMessages from going to the wrong place, though some of the proposed solutions directly conflict with what some of the affected users have told Ars. Our friends at Macworld posted an article on Thursday claiming that a simple three-step process should help prevent this from happening:

Macworld can confirm that perhaps the easiest way to ensure that a stolen phone stops receiving iMessages is to remotely wipe the phone, and then call your carrier and instruct them to deactivate your old SIM. The third and final step? Activate a new SIM in your new phone.
Completing those three steps—wiping, deactivating your old SIM, and then activating a new one—ensures that your iMessages will get sent only to you and your iOS devices, and not anywhere else.

We were unable to test this ourselves, so we're taking Macworld at their word—I spoke with the author of the piece, Lex Friedman, who told me he tested it personally with success. I went back to speak with Hovis with this article in hand, however, and he told me that he performed those same steps in the same order without success—the messages still went through to the owner of the stolen phone. Our only guess is that Apple has already made some changes to iMessage on the server side between the time Hovis performed his remote wipe and the time Friedman performed his remote wipe, but this remains unconfirmed.

Setting a SIM PIN

There is another, slightly more complicated process that will also work to lock out stolen iPhones from your iMessages, but be warned: it could also block you from finding the phone via Find My iPhone if the thief reboots your phone. You can set a PIN on your SIM card, which is different than setting a PIN for the phone. The reason this is a less-ideal solution isn't just because it's more complicated—it's also because each carrier already has a default PIN set for your SIM card, and you risk locking yourself out from your own account if you don't do this correctly.

I recommend reading Jesse Hollington's Google+ post (and the corresponding comments) on how to set a PIN on your SIM; it contains the default SIM codes for most of the popular carriers in the US and Canada. Please note that the SIM PIN trick won't work for Verizon iPhones—there is no SIM, and you can potentially lock yourself out much easier if you try to set a PIN for your nonexistent card. (Read the comment by Josh Schoenwald in the aforementioned Google+ post to find out what happens when you try to do this. Don't feel bad, Josh—you're helping everyone else learn!)

Still, our sources tell us that performing the aforementioned three-step process (remote wipe, deactivation, then activation on a new SIM) should work from this point on to lock out a stolen iPhone. So if you find yourself having some bad luck with thieves, it's worth trying that method before trying to set a PIN on your SIM card.

We'll keep you updated if and when we hear anything new about this issue, and please keep e-mailing me with your stories and observations about iMessage.

Source: 

Arstechnica

Occupy Geeks Are Building a Facebook for the 99%

Protesters volunteering for the internet and information boards of the Occupy Wall Street protest work and broadcast from their media center in Zuccotti Plaza on Oct. 2, 2011. Photo: Bryan Derballa for Wired.com

“I don’t want to say we’re making our own Facebook. But, we’re making our own Facebook,” said Ed Knutson, a web and mobile app developer who joined a team of activist-geeks redesigning social networking for the era of global protest.
They hope the technology they are developing can go well beyond Occupy Wall Street to help establish more distributed social networks, better online business collaboration and perhaps even add to the long-dreamed-of semantic web — an internet made not of messy text, but one unified by underlying meta-data that computers can easily parse.

The impetus is understandable. Social media helped pull together protesters around the globe in 2010 and 2011. Egyptian dictator Hosni Mubarak so feared Twitter and Facebook that he shut down Egypt’s internet service. A YouTube video posted in the name of Anonymous propelled Occupy Wall Street from an insider meme to national news. And top-trending Twitter hashtags turned Occupy from a ho-hum rally on Sept. 17 into a national and even international movement.

Now it’s time for activists to move beyond other people’s social networks and build their own, according to Knutson.

“We don’t want to trust Facebook with private messages among activists,” he said.
The same thinking applies to Twitter and other social networks — and the reasoning became clear last week, when a Massachusetts district attorney subpoenaed Twitter for information about the account @OccupyBoston and other accounts connected to the Boston movement. (To its credit, Twitter has a policy of giving users the opportunity to contest such orders when possible.)

“Those networks will be perfectly fine — until they are not. And it will be a one-day-to-the-next thing,” said Sam Boyer, an activist turned web developer, turned activist again, who works with the New York City occupation’s tech team.

A move away from mainstream social networks is already happening on several levels within the Occupy movements — from the local networks already set up for each occupation to an in-progress, overarching, international network project called Global Square, that Knutson is helping to build. Those networks are likely to be key to Occupy’s future, since nearly all of the largest encampments in the United States have been evicted — taking with them the physical spaces where activists communicated via the radically democratic General Assemblies.

The idea of an open alternative to corporate-owned social networking sites isn’t novel — efforts to build less centralized, open source alternatives to Facebook and Twitter have been in the works for years, with the best known examples being Diaspora and Identica.

But those developments aren’t specifically focused on protest movements. And the Occupy movement’s surprising rise in the U.S. has added new impetus to the desire for open source versions of the software that is playing an increasingly important role in mobilizing and connecting social movements, as well as broadcasting their efforts to the world.

One challenge that all of the new efforts face is a very difficult one for non-centralized services: ensuring that members are trustworthy. That’s critical for activists who risk injury and arrest in all countries and even death in some. To build trust, local and international networks will use a friend-of-a-friend model in Knutson and Boyer’s projects. People can’t become full members on their own as they can with social networks like Twitter, Facebook and Google+.

“You have to know someone in real life who sponsors you,” said Knutson.
To Boyer, it’s more important to identify someone as trustworthy than to ensure that their online name matches a passport or birth certificate.

“I respect pseudonyms as long as they treat them as pseudonyms and not as masks,” said Boyer. In other words, someone shouldn’t hide behind a fake name to get away with bad behavior — in an extreme case, infiltrating the movement to spy on or sabotage it.

Thirty-six-year-old Knutson, who lives in Milwaukee, Wisconsin, started the year as an observer of politics before evolving into a committed OWS activist. His metamorphosis started during public-employee strikes in February against proposed policies of Governor Scott Walker that would affect their benefits and collective-bargaining rights.

“Before this year we had the idea that things maybe were starting to improve a little,” he said. “But when things started happening in February we were like, ‘No, no. Things are getting worse.’”
While organizing a “Walkerville” protest camp in June, Knutson met, over Twitter, members of Spanish protest movement 15M. They had just built a web site, Take the Square, to track occupations around the world, from Tunisia to Madrid. He also met Alexa O’Brien – founder of campaign-finance-reform organization US Day of Rage and a co-founder of Occupy Wall Street. After OWS kicked off, Knutson came to the East Coast for a while, visiting New York, Boston and Philadelphia and joining with other techies in those cities.

Through all those connections, Knutson has focused on building the technology for an international occupations network. But the politics are tricky. “Some of the people in Spain are kind of resentful of OWS, because they got all of the credit,” he said, noting that the Spanish occupations started first and are still far bigger.

As a counterpart to Knutson, Sam Boyer focuses on the US occupations, building tech for a collection of interlinked social networks across the country with the working title Federated General Assembly, or FGA. Working on Occupy has brought him full-circle.

When he was an undergrad in 2005, Boyer, who is now 27, took a job at the Student Trade Justice Campaign, an organization focused on trade policy reform. In 2007, he wanted to build an online platform for individual chapters to organize into groups and to link those groups for national discussions – essentially what the FGA is meant to do. But Boyer couldn’t build it, he said. “I didn’t even know how to program at the point that I started with it.”

So Boyer started learning, and falling in love with, Web programming; and he switched from being mainly an activist to mainly an engineer. His specialty is an open-source content-management system for web sites called Drupal, which FGA will run on.

Knutson, Boyer and the other Occupy geeks don’t have to build everything from scratch. “These are standards that have been around for a while, and we are not reinventing the wheel,” said Boyer.
For instance, the projects will rely on set of technologies known as Open ID and OAuth that let a user sign into a new website using their logins and passwords from social networks like Facebook, Google and Twitter. Those technologies let you sign up for a new service by logging into a Twitter or Google account, which vouch for you to the new site without giving over your password or forcing you to get yet another username and password to keep track of.

In the new OWS tech, an activist’s local-occupation network can vouch for a user to another network, and the local networks all trust each other, they all trust that activist. Someone can sign into one network and post and comment on them all.

Some sensitive posts, say about civil disobedience, would be private. Others, like a statement of demands or press release, would be public, but only trusted members of the network could create them.
FGA wants to differentiate itself from the the me-me-me narcissism of Facebook. It has a strong focus on groups — working together on topics like alternative banking or electoral reform.

And there’s a lot of work today. Currently, the group aspects of Occupy web sites are a cacophony.
“You get there, and the first thing you look at is this useless activity feed,” said Boyer. Every comment – whether a brilliant idea, a troll comment or a me-too pile-on – pops into the list as it’s generated. “You’re only guaranteed that one person really thought that post was a good idea – not the whole group,” he said.
In the FGA system, each group has a discussion on what information to push to their home page, such as a description of an event, a blog post or minutes from a meeting. “In the same way that, when you look at Reddit, you know that the articles on top are the most upvoted, the user could know that posts appearing on a front page represent the concerted agreement of the group,” said Boyer.

The activist coders also want to be able to push and pull info to and from the rest of the movement. The idea is that they can have disparate systems that label info with shared tags that will, some day, make it possible to enter a search on any one site and pull precise results from around the world.

Ed Knutson’s job is to get those sites talking to each other, even though the content may be in different languages (English, Spanish, Arabic, etc.) and created with different content management systems, or CMSs, such as Drupal or Wordpress. The Global Square network will connect not through those systems but through “semantic Web” standards designed to link up disparate technologies.

One key standard has the wordy name Resource Description Framework, or RDF, a universal labeling system.

If an occupier wants to post the minutes of a meeting, for example, they might type them in the appropriate text box in the content management software running the site. That software pushes the information to an RDF database and tags it with some universal label – it could be called “minutes” or any other term that all the occupations agree on. The local occupier might also select “Group: Alternative Banking” from a dropdown list, and that label would be added as well. Using the same labels allows all the sites to trade information. So a search for minutes from an Alternative Banking group would pull up records from any occupation with that kind of group.

With RDF, sites can work together even if they run on different content management software, such as Drupal (as in the FGA) or Wordpress (as in the Spanish M15 group).

“The handoff point is that everything goes through RDF,” said Knutson. “You don’t care if they have a Drupal site or some kind of Frankenstein combination of different stuff.”

The problem the coders face will be the same one that’s faced the web for years – getting people to agree on standards and to then adopt them. One long-running attempt to do this quickly is called Microformats – a way of including markup data in HTML that’s invisible to an human visitor, but which can be understood by their browser or by a search engine. Examples include marking up contact information so that a reader can simply click contact information to add it to their address book and annotating a recipe so that search engines can let you search for recipes that include ’spinach’.
These linkage and collaboration capabilities would be useful well beyond the Occupy movement.
“I think any type of small or medium-sized group or a team that has one person in eight different cities,” could use it for collaboration, says Knutson. And he sees no reason against spinning off the tech to businesses.
“Every small and medium business owner is a member of the 99%,” said Knutson. “Furthermore, exploring relationships with businesses… is pretty important to having a tangible impact.”

“A lot of what we are tying to do is build a better conversation so that this cacophonous discussion can be more coordinated,” said Boyer. As an analogy, he recounted an OWS workshop from a conference on December 18 in New York City when the moderator asked everyone to shout out their best idea for the movement.

They were probably all good ideas, said Boyer. But he couldn’t hear any one of them through the noise of the others.

The Web of trust among networks, RDF labels that link data across occupations, working-group consensus on what to post – all are designed to help the right people connect to each other and to the right information. “Let the sheer number of people who are interested get out the way of the many things actually happening,” said Boyer.

But for now, all those ideas are just that – ideas. And whatever does emerge will come piecemeal.
Sam Boyer hopes to launch in the following weeks what he calls a stepping stone — a roster of occupations around the world called, for now, simply directory.occupy.net. M15’s Take the Square site has provided something like that since May, as have other sites. But directory.occupy.net will be unique in using RDF and other technologies to label all the entries. It will also allow people from each occupation to “own” and update their entries.

“The directory should be useful, but it’s not our big debut,” said Boyer. He’s hoping that will be sometime in the spring, when a rough version of the FGA social network launches.

The Global Square Knutson is helping to build is finalizing its tech and will launch, probably in January, with basic linkages for various Occupy sites to trade messages, re-publish articles and allow cross-commenting on them.

“I’d say it would be a pretty major accomplishment to get a couple of the [web site] systems that everyone is using, like ELGG and Drupal and media wiki and maybe Wordpress” to work together, he said.
But even just having the discussion has been a big deal. “It’s hard to get people to even think about that kind of stuff.”

Source-
Wired

2011 is the Year of the Hacktivist, Verizon Report Suggests

Verizon Business's Bryan Sartin, who investigates corporate break-ins, saw red this year over hacktivist threats to clients.

Postal workers, department store clerks and elves aren’t the only ones working like crazy this holiday season. For Bryan Sartin, it’s the busiest time of year.

Sartin is a director of investigative response with Verizon Business. He’s the guy you call when you’ve been hacked and he usually doesn’t get much of a Christmas vacation.

“Right before big holidays, particularly Christmas and New Year’s is when the very vast majority of people seem to find out that they’ve been hacked,” he says. “We’ll do as much as 20 percent of our annual caseload during this part of December.”

In 2010, about 92 percent of those cases involved criminals trying to steal money over the internet, but this year everything changed.

The first signs emerged in December 2010, when activists with the online collective Anonymous called for digital sit-ins — known as distributed denial of service attacks — on the websites of companies that had refused to process payments for Wikileaks. Then, in early 2011, attacks on Sony, HBGary and many law enforcement agencies hit the headlines. None of them appear to have been financially motivated.
That’s meant big changes in the kinds of threats that companies are preparing for.

Sartin helps compile a widely watched yearly study of data breaches, and he says that hacktivist and state-sponsored attacks will show up in this year’s report, big time. “That trend has certainly continued this year and it will embody itself in a big way in our upcoming study.”


But for all the high-profile LulzSec and Anonymous attacks this year, Sartin still believes the hacktivist threat — long ignored by corporate IT — is now frequently overhyped.

He says clients often approach Verizon after they see a Twitter message or an internet post threatening an attack on a pre-determined day. The company gears up for an event, bringing consultants on site, and ordering technical staff to be at the ready.

It’s not cheap, and most of the time, nothing happens. “Very commonly, when companies are receiving these kinds of threats in advance, no one ever makes good on them,” he says.

Last year, reported cyber-threats to the New York Stock Exchange, the Federal Reserve, and Facebook never materialized.

In one actual attack — Sartin wouldn’t name the company — criminals broke in and got access to a database filled with encrypted client data. Looking at the logs, Verizon investigators could see that the attackers had downloaded all of the encrypted data — something that would force the company to notify its customers that their data had been accessed. But they didn’t download the one most useful table of all — an unencrypted list of the encryption keys that could be used to decrypt all of the data they had stolen.

“They were stealing data with no interest in deciphering the encryption,” he says. “They were just stealing it to force this company into making a disclosure.”

While the hacktivists may be overhyped, Sartin says they’re often better than the other hackers out there. According to him, many attacks that are thought to be state sponsored, are surprisingly unsophisticated. Known as advanced persistent threat attacks, Sartin calls them “awfully persistent, but not so advanced.”
There’s one more surprise that will show up in the 2012 Data Breach Report, which will include a lot more data sources from Europe and Asia than previous reports.

“In this part of the world, China is the source of a lot of our crimes, but if you go to China … the U.S. is the number one source of electronic crimes,” Sartin says. “Over here we think that all of these advanced persistent threats and things come from China. Over there, they think they all come from here.”

Source: 

Wired (Threat Level)